Skip to content

Instantly share code, notes, and snippets.

@hasherezade
hasherezade / Program.cs
Last active July 27, 2021 06:48
A simple app to decode #PurpleFoxEK stegano payloads
using System;
using System.Drawing;
using System.IO;
namespace PurpleFoxPNGDec
{
internal class Program
{
public static int getPrintableLen(byte[] array)
{
#include <stdio.h>
#include <Windows.h>
#include <psapi.h>
#include <string>
HANDLE create_new_process(IN const char* path, IN const char* cmd)
{
STARTUPINFOA si;
memset(&si, 0, sizeof(STARTUPINFO));
@hasherezade
hasherezade / AddToShell.reg
Last active June 9, 2021 04:32
PIN_runner
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\*\shell\PIN_run]
@="Run with PIN"
[HKEY_CLASSES_ROOT\*\shell\PIN_run\command]
@="\"C:\\Pin_Tools\run_me.bat\" \"%1\""
@hasherezade
hasherezade / buid_hh.sh
Last active December 29, 2020 14:22
Build Hollows Hunter on Linux (MinGW)
#!/bin/sh
set -e
test -d _hollows_hunter \
|| git clone --recurse-submodules https://github.com/hasherezade/hollows_hunter _hollows_hunter
cd _hollows_hunter
cmake . \
-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc \
@hasherezade
hasherezade / msil_dec.py
Last active July 11, 2020 13:06
Helper script for decoding some .NET cryptor
#!/usr/bin/python2.7
import argparse
def decode(data, key, offset, extra_rounds):
maxlen = len(data)
keylen = len(key)
j = 0 #key index
num2 = (maxlen - 1) * (extra_rounds + 1)
decoded = bytearray()
@hasherezade
hasherezade / search_lib.py
Last active May 28, 2020 20:28
Search library in PE file
import pefile
import os
def list_files(dir, ext):
file_list = []
for root, dirs, files in os.walk(dir):
for file in files:
if file.endswith(ext):
path = os.path.join(root, file)
file_list.append(path)
@hasherezade
hasherezade / pastebin_api_test.py
Created November 28, 2016 04:38
Pastebin API test
#!/usr/bin/python2.7
import sys
import urllib2
method = 'POST'
content_type = 'text/html'
agent = 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130921 Firefox/24.0'
host = 'pastebin.com'
#include "QNumberEdit.h"
QString QNumberEdit::PREFIX = "0x";
QNumberEdit::QNumberEdit(QWidget *parent)
: QLineEdit(parent)
{
QRegExp re("("+PREFIX+")?[0-9A-Fa-f]+");
validator = new QRegExpValidator(re, this);
@hasherezade
hasherezade / str_ref.py
Created January 28, 2020 01:42
IDA script snippets
#IDA script to print all referenced strings along with their references
import idautils
sc = idautils.Strings()
for s in sc:
curr_str = str(s)
str_offset = s.ea
for xref in idautils.XrefsTo(s.ea):
func = idaapi.get_func(xref.frm)
@hasherezade
hasherezade / lookup.cpp
Last active January 9, 2020 23:44
Zbot - checksum lookup (v2)
#include <Windows.h>
#include <tlhelp32.h>
#include <iostream>
#include <peconv.h> // include libPeConv header (https://github.com/hasherezade/libpeconv)
#include <paramkit.h> // include ParamKit header (https://github.com/hasherezade/paramkit)
using namespace paramkit;
#define PARAM_CHECKSUM "checks"
#define PARAM_CHECKSUM_FUNC "cfunc"